diff --git a/web/public/_headers b/web/public/_headers
new file mode 100644
index 0000000..c9b8119
--- /dev/null
+++ b/web/public/_headers
@@ -0,0 +1,10 @@
+# Cloudflare Workers static-assets cache policy (07-04, D-06).
+# Vite emits content-HASHED files under /assets/* — a hashed URL's bytes can
+# never change, so they are immutable for a year. The HTML entry is NOT
+# hashed (it points at the current hashed assets) — it must revalidate on
+# every visit or a stale entry would point at deleted asset files.
+/assets/*
+  Cache-Control: public, max-age=31556952, immutable
+
+/
+  Cache-Control: public, max-age=0, must-revalidate